Skip to content
Fencer Vulns
high 7.3

CVE-2021-37851 json

Local Privilege Escalation in ESET product for Windows

published 2022-05-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-24330

cvss
7.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

Local privilege escalation in Windows products of ESET allows user who is logged into the system to exploit repair feature of the installer to run malicious code with higher privileges. This issue affects: ESET, spol. s r.o. ESET NOD32 Antivirus 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Internet Security 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Smart Security Premium 11.2 versions prior to 15.1.12.0. ESET, spol. s r.o. ESET Endpoint Antivirus 6.0 versions prior to 9.0.2046.0; 6.0 versions prior to 8.1.2050.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Endpoint Security 6.0 versions prior to 9.0.2046.0; 6.0 versions prior to 8.1.2050.0; 6.0 versions prior to 8.0.2053.0. ESET, spol. s r.o. ESET Server Security for Microsoft Windows Server 8.0 versions prior to 9.0.12012.0. ESET, spol. s r.o. ESET File Security for Microsoft Windows Server 8.0.12013.0. ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server 6.0 versions prior to 8.0.10020.0. ESET, spol. s r.o. ESET Mail Security for IBM Domino 6.0 versions prior to 8.0.14011.0. ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server 6.0 versions prior to 8.0.15009.0.

Patch / fix

  • ESET, spol. s r.o. ESET NOD32 Antivirus 15.1.12.0
  • ESET, spol. s r.o. ESET Internet Security 15.1.12.0
  • ESET, spol. s r.o. ESET Smart Security Premium 15.1.12.0
  • ESET, spol. s r.o. ESET Endpoint Antivirus 8.0.2053.0, 8.1.2050.0, 9.0.2046.0
  • ESET, spol. s r.o. ESET Endpoint Security 8.0.2053.0, 8.1.2050.0, 9.0.2046.0
  • ESET, spol. s r.o. ESET Server Security for Microsoft Windows Server 9.0.12012.0
  • ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server 8.0.10020.0
  • ESET, spol. s r.o. ESET Mail Security for IBM Domino 8.0.14011.0
  • ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server 8.0.15009.0

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • ESET, spol. s r.o. ESET NOD32 Antivirus
  • ESET, spol. s r.o. ESET Internet Security
  • ESET, spol. s r.o. ESET Smart Security Premium
  • ESET, spol. s r.o. ESET Endpoint Antivirus
  • ESET, spol. s r.o. ESET Endpoint Security
  • ESET, spol. s r.o. ESET Server Security for Microsoft Windows Server
  • ESET, spol. s r.o. ESET File Security for Microsoft Windows Server
  • ESET, spol. s r.o. ESET Mail Security for Microsoft Exchange Server
  • ESET, spol. s r.o. ESET Mail Security for IBM Domino
  • ESET, spol. s r.o. ESET Security for Microsoft SharePoint Server

Classification

Weakness
  • CWE-280 Improper Handling of Insufficient Permissions or Privileges
  • CWE-755 Improper Handling of Exceptional Conditions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.